ci: put CI keychain first in codesign search list

codesign resolves signing identities through the user keychain search
list (first match wins) and ignores --keychain for the lookup. This
runner hosts another project whose keychain holds the same Apple
Distribution identity, so when that keychain is locked, codesign fails
with errSecInternalComponent no matter how correctly our own keychain
is set up. Prepend the fresh CI keychain to the search list for the
build and always delete it afterward, which restores the original list.

Also drop the runner-diagnostics step, the GitHub-hosted Ruby PATH
export, and the duplicate CODE_SIGN_IDENTITY param.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitea/workflows/testflight.yml

@@ -8,16 +8,11 @@ on:
 
 jobs:
   testflight:
-    runs-on: xcode
-    defaults:
-      run:
-        shell: bash
+    runs-on: macos-arm64
 
     steps:
       - name: Checkout
         uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
 
       - name: Setup Ruby
         uses: ruby/setup-ruby@v1
@@ -27,16 +22,11 @@ jobs:
           working-directory: ios
 
       - name: Install XcodeGen
-        run: |
-          set -euo pipefail
-          if ! command -v xcodegen >/dev/null 2>&1; then
-            brew install xcodegen
-          fi
+        run: command -v xcodegen >/dev/null 2>&1 || brew install xcodegen
 
       - name: Upload to TestFlight
         working-directory: ios
         env:
-          HOME: /var/lib/act_runner
           APP_STORE_CONNECT_KEY_ID: ${{ secrets.APP_STORE_CONNECT_KEY_ID }}
           APP_STORE_CONNECT_ISSUER_ID: ${{ secrets.APP_STORE_CONNECT_ISSUER_ID }}
           APP_STORE_CONNECT_KEY_CONTENT: ${{ secrets.APP_STORE_CONNECT_KEY_CONTENT }}
@@ -46,7 +36,4 @@ jobs:
           SYBIL_BUILD_NUMBER: ${{ github.run_number }}
           FASTLANE_SKIP_UPDATE_CHECK: "1"
           FASTLANE_XCODEBUILD_SETTINGS_TIMEOUT: "120"
-        run: |
-          export PATH="/Users/runner/hostedtoolcache/Ruby/3.1.7/arm64/bin:${PATH}"
-          ruby --version
-          bundle exec fastlane ios beta
+        run: bundle exec fastlane ios beta

ios/fastlane/Fastfile

@@ -8,8 +8,7 @@ TEAM_ID = "DQQH5H6GBD"
 PROFILE_NAME = "Sybil AppStore CI"
 CI_KEYCHAIN_NAME = "sybil_ci_keychain"
 CI_KEYCHAIN_PASSWORD = "sybil-ci-keychain-password"
-CI_KEYCHAIN_PATH = File.expand_path("~/Library/Keychains/#{CI_KEYCHAIN_NAME}")
-CI_KEYCHAIN_DB_PATH = "#{CI_KEYCHAIN_PATH}-db"
+CI_KEYCHAIN_DB_PATH = File.expand_path("~/Library/Keychains/#{CI_KEYCHAIN_NAME}-db")
 IOS_ROOT = File.expand_path("..", __dir__)
 PROJECT_FILE = File.join(IOS_ROOT, "Sybil.xcodeproj")
 PROJECT_SPEC = File.join(IOS_ROOT, "project.yml")
@@ -62,26 +61,6 @@ def stamp_marketing_version(version)
   File.write(APP_PROJECT_SPEC, updated)
 end
 
-def ci_keychain_path
-  File.file?(CI_KEYCHAIN_DB_PATH) ? CI_KEYCHAIN_DB_PATH : CI_KEYCHAIN_PATH
-end
-
-def signing_xcargs
-  args = [
-    "DEVELOPMENT_TEAM=#{TEAM_ID.shellescape}",
-    "CODE_SIGN_STYLE=Manual",
-    "CODE_SIGN_IDENTITY=Apple\\ Distribution",
-    "PROVISIONING_PROFILE_SPECIFIER=#{PROFILE_NAME.shellescape}"
-  ]
-
-  if ci?
-    args << "CODE_SIGN_KEYCHAIN=#{ci_keychain_path.shellescape}"
-    args << "OTHER_CODE_SIGN_FLAGS=#{("--keychain #{ci_keychain_path}").shellescape}"
-  end
-
-  args.join(" ")
-end
-
 platform :ios do
   private_lane :app_store_api_key do
     app_store_connect_api_key(
@@ -92,21 +71,31 @@ platform :ios do
     )
   end
 
-  # CI uses a dedicated throwaway keychain for match. build_app passes this
-  # keychain explicitly so codesign does not depend on the runner's ambient
-  # login/default keychain state.
+  # CI signs headlessly, so match needs a fresh unlocked keychain to import
+  # into. codesign resolves identities through the user keychain *search list*
+  # (first match wins; the --keychain flag does not restrict the lookup), and
+  # other projects' keychains on this runner hold the same identity but are
+  # usually locked — so ours must come first. delete_keychain in the beta
+  # lane's ensure removes both the keychain and its search-list entry, which
+  # also keeps our (later locked) copy from shadowing those other projects.
   private_lane :prepare_ci_keychain do
     next unless ci?
 
-    delete_keychain(name: CI_KEYCHAIN_NAME) if File.file?(CI_KEYCHAIN_DB_PATH) || File.file?(CI_KEYCHAIN_PATH)
+    delete_keychain(name: CI_KEYCHAIN_NAME) if File.file?(CI_KEYCHAIN_DB_PATH)
     create_keychain(
       name: CI_KEYCHAIN_NAME,
       password: CI_KEYCHAIN_PASSWORD,
       unlock: true,
       timeout: 3600,
-      add_to_search_list: true
+      add_to_search_list: false
     )
 
+    others = sh("security list-keychains -d user", log: false)
+      .scan(/"([^"]+)"/)
+      .flatten
+      .reject { |path| path.include?(CI_KEYCHAIN_NAME) }
+    sh("security list-keychains -d user -s #{([CI_KEYCHAIN_DB_PATH] + others).shelljoin}")
+
     ENV["MATCH_KEYCHAIN_NAME"] = CI_KEYCHAIN_NAME
     ENV["MATCH_KEYCHAIN_PASSWORD"] = CI_KEYCHAIN_PASSWORD
   end
@@ -150,8 +139,12 @@ platform :ios do
       project: PROJECT_FILE,
       scheme: SCHEME,
       export_method: "app-store",
-      codesigning_identity: "Apple Distribution",
-      xcargs: signing_xcargs,
+      xcargs: [
+        "DEVELOPMENT_TEAM=#{TEAM_ID.shellescape}",
+        "CODE_SIGN_STYLE=Manual",
+        "CODE_SIGN_IDENTITY=Apple\\ Distribution",
+        "PROVISIONING_PROFILE_SPECIFIER=#{PROFILE_NAME.shellescape}"
+      ].join(" "),
       export_options: {
         signingStyle: "manual",
         teamID: TEAM_ID,
@@ -165,5 +158,7 @@ platform :ios do
       api_key: api_key,
       skip_waiting_for_build_processing: true
     )
+  ensure
+    delete_keychain(name: CI_KEYCHAIN_NAME) if ci? && File.file?(CI_KEYCHAIN_DB_PATH)
   end
 end